Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete−
Learning path 05 · Configure your Microsoft Sentinel environment ↗

6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR

0%

Study focus

Sentinel foundation

Understand the SIEM workflow and design workspaces, permissions, retention, and data tiers.

Security context

Use logs, watchlists, threat intelligence, and Defender XDR integration to support operations.

6 modules · 42 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

04Use watchlists in Microsoft Sentinel0/6 units−
04

Module 4

Use watchlists in Microsoft Sentinel

Focus: external reference datasets, search keys, KQL access, and controlled update workflows.
0/6
01 / 06Introduction

A watchlist is a named dataset imported into Sentinel for fast enrichment, filtering, correlation, hunting, analytics, workbooks, notebooks, and playbooks.

Official moduleWatchlist objectives
02 / 06Plan for watchlists

Common watchlists contain high-value assets, privileged or terminated users, approved IP addresses, service accounts, known file hashes, business ownership, or allow/block lists. Use them to enrich events or reduce noise from explicitly understood benign activity.

Choose a stable, populated SearchKey column that will be used most often in filters, lookups, or joins. Watchlists are cached for low-latency query access, but they are reference data rather than a replacement for continuous log ingestion.

Official lessonWatchlist scenarios and design
03 / 06Create a watchlist
  1. Open Sentinel > Configuration > Watchlists and select Add new.
  2. Provide name, description, and alias.
  3. Upload the dataset, choose the search key, review, and create.
  4. Wait for the watchlist to become available, then test it with KQL.
_GetWatchlist('HighValueMachines')

The lesson states a 3.8-MB upload limit. Use the alias in _GetWatchlist(), and protect sensitive business data through workspace access controls.

Official lessonCreate and query a watchlist
04 / 06Manage watchlists

Edit individual items for small changes. A bulk update appends rows and deduplicates only when all column values match; it does not remove existing items omitted from the uploaded file. The search-key column must exist and contain no blank values.

Prefer editing over delete-and-recreate. Log Analytics has a five-minute ingestion SLA, so recreation can briefly expose both old and new records.

Exam takeaway: bulk update is append-and-deduplicate, not full synchronization.
Official lessonItem edits and bulk updates
05 / 06Module assessment

Review watchlist use cases, aliases, the search key, _GetWatchlist(), file limits, and the difference among item editing, bulk update, and recreation.

Official assessmentWatchlist knowledge check
06 / 06Summary and resources

Use governed watchlists for compact external context that improves detection and investigation, and maintain them with stable schemas, search keys, owners, and documented update processes.

Official moduleSummary and resources
End of learning pathConfigure your Microsoft Sentinel environment
↑